Apache Incubator distribution directory

To find the complete download and installation instructions and other
information for a particular project, start at the project's own webpage.
Find them via
Incubator projects
listing, rather than browsing the directories below.

Important notices

Each Apache Incubator podling is an effort undergoing incubation
at The Apache Software Foundation (ASF). Incubation is required of all
newly accepted projects until a further review indicates that the
infrastructure, communications, and decision making process have
stabilized in a manner consistent with other successful ASF projects.
While incubation status is not necessarily a reflection of the
completeness or stability of the code, it does indicate that the project
has yet to be fully endorsed by the ASF.

Verify downloaded artefacts

It is essential that you verify the integrity of the downloaded files
using the MD5 and PGP signatures. MD5 verification ensures the file was
not corrupted or tampered with. PGP verification ensures that the file
came from a certain person.

Each project will probably have its own instructions on its download page.
If not, then the following notes will help.

PGP signature

The PGP signatures can be verified using
PGP or
GPG. First download the project's
KEYS file as well as the
*.asc signature file for the particular artefact. It is
important that you get these files from the ultimate trusted source - the
main ASF distribution site, rather than from a mirror. Then verify the
signatures using ...

MD5 checksum

To verify the MD5 checksum on the files, you need to use a program called
md5 or md5sum, which is included in many unix
distributions. It is also available as part of
GNU
Textutils. Windows users can get binary md5 programs from
here,
here, or
here or an openssl client
from
here.